Cybersecurity first. A safer online world for all. Practical tools and guides for a digital future. A 2026 Champion of Cybersecurity Awareness Month. What you check stays on your phone or computer.

Essay · 13 November 2026

The Digital Trust Deficit.

The future of online safety depends on who gets left behind.

Seventy-three per cent of adults believe they can identify a scam, and 23 per cent have lost money to one, according to a 2025 survey of 46,000 adults in 42 countries by the Global Anti-Scam Alliance, an international coalition against fraud. In the same year, the Federal Bureau of Investigation’s Operation Level Up notified 3,780 people that they were caught in a cryptocurrency investment fraud, and 78 per cent of them had not known.

Confidence is common, and people often learn the truth late, when someone else tells them, as the Bureau’s agents did. The distance between the two is what this essay calls the digital trust deficit: the gap between how quickly the means of impersonation spread and how quickly the means of checking reach people. The gap is not shared equally. The evidence below shows who meets it first and who pays most for it, and it supports one conclusion: the future of online safety depends on who gets left behind.

How large is the harm, and how well is it counted?

All dollar figures are United States dollars and pound figures are pounds sterling. Each source counts differently, so the rows cannot be added together. The Federal Bureau of Investigation counts complaints filed with it, the Federal Trade Commission counts reports filed with it, and Gallup, the polling organisation, surveyed adults and estimated the total. Gallup found that 13 per cent of scams were reported to the Federal Trade Commission or federal law enforcement. The Federal Trade Commission has estimated that the full cost of fraud to American consumers in 2024 could be as high as $195.9 billion, against about $12 billion reported. The Federal Bureau of Investigation also states that complainants are not required to give an age range, so its age figures describe only the people who did.

What do the market labels leave out?

Two labels from financial markets name industries by the fall in their share prices. In February 2026, after a sharp fall in software shares, Jeffrey Favuzza of the equity trading desk at the investment bank Jefferies called it the SaaSpocalypse, an apocalypse for shares in software-as-a-service companies, meaning software rented by the user each month. In October 2026 the investor Steve Eisman said on his podcast, The Real Eisman Playbook, in the episode for the week ending 16 October, that he thought he had coined the Telepocalypse, his name for SpaceX’s Starlink becoming a viable competitor to the three largest United States mobile networks.

The labels describe falling share prices. The harm this essay follows is recorded instead in complaints, surveys and reimbursement rules.

Why has being careful stopped being enough?

A study by Sarah Barrington, Emily Cooper and Hany Farid, published in Scientific Reports and first posted in October 2024, played participants recordings of under 20 seconds. Participants judged an artificial voice to be the real speaker’s voice 80 per cent of the time and correctly labelled a voice as artificial 60 per cent of the time. The authors report that performance did not depend on the demographics of the speaker or the listener, which means no group of listeners was better at it.

Cloning is within reach of many people. When Consumer Reports, the American testing organisation, examined six voice-cloning tools in March 2025, four had no meaningful check that the person being copied had agreed, four were free, and the two paid tools cost $5 and $1. The Federal Bureau of Investigation’s 2025 report counted 22,364 complaints that mentioned artificial intelligence, with losses above $893 million. It records that cloned voices are used in scams where a relative appears to be in distress, with victims claiming losses above $5 million. In investment scams, losses with a likely artificial intelligence link passed $632 million out of more than $8 billion in total, and the report adds that many victims do not realise how far artificial intelligence is involved.

Labels on synthetic content have limits. A peer-reviewed study presented in November 2025 tested AudioSeal, a widely used watermarking tool for speech, and found that the watermarks could not reliably separate artificial from genuine speech. The authors say the result casts doubt on watermarking more generally, although the tests covered one tool.

What still works is a second route to the person. The person can hang up and call back on a number the organisation publishes, or ask a question that only the real person could answer, using a code word the family agreed in advance.

Who is paying, and how does the harm differ?

As with the pandemic, when a 2021 study by Lourdes Guerrero and Steven Wallace in Frontiers in Public Health found that older adults of colour in the United States faced the highest risk of poor outcomes, a danger that reaches everyone does not reach everyone alike. The difference follows what people already have: money, time, language, connection and someone to ask.

Adults aged 60 and over. Americans in this group filed 201,266 complaints with the Federal Bureau of Investigation in 2025, up 37 per cent, and reported $7.748 billion in losses, up 59 per cent, with an average loss of $38,500. In 12,444 complaints the loss was above $100,000. The largest losses were in investment fraud ($3.519 billion), tech support fraud ($1.041 billion) and romance and confidence fraud ($584 million). The Federal Trade Commission reports that older adults’ reported losses reached $3 billion in 2025, up from about $600 million in 2020. Cryptocurrency kiosks, the machines that turn cash into cryptocurrency, took $389 million in reported losses in 2025, and adults aged 60 and over made 6,188 of the 13,460 complaints and carried 76 per cent of the losses where the victim’s age was known.

Adults in their twenties. Of adults in their twenties who filed fraud reports with the Federal Trade Commission in 2024, 44 per cent said they lost money, against 24 per cent of those in their seventies (Federal Trade Commission, 2024, as reported by Axios). The Federal Bureau of Investigation recorded 112,069 complaints from this group in 2025, with $563.1 million in losses.

Black and Hispanic Americans. In a 2024 Consumer Reports survey, among Americans who had met a cyberattack or digital scam, 33 per cent of Black respondents and 30 per cent of Hispanic respondents had lost money, against 13 per cent of white respondents, a difference that held after controlling for gender, age and household income. The report points to Federal Trade Commission research from 2021 finding that Black and Hispanic consumers more often pay by methods with fewer legal protections, which leaves less chance of getting money back. Consumer Reports adds that Black communities filed more reports than white and Latino communities, so under-reporting does not explain the gap.

Lower-income adults and adults without a degree. Gallup found victimisation higher among lower-income adults, people of colour and adults without a bachelor’s degree, with a median loss of $500 and 46 per cent of victims describing moderate or severe hardship in their households. While 79 per cent of victims reported to at least one organisation, mostly banks and payment platforms, 13 per cent of scams reached the Federal Trade Commission or federal law enforcement. Among victims who did not report, 75 per cent did not believe reporting would help, and 65 per cent of all adults said they would not know where to report a $5,000 scam.

Women. A 2026 report by the United Nations Entity for Gender Equality and the Empowerment of Women, known as UN Women, titled “Tipping point: Online violence impacts, manifestations and redress in the AI age”, surveyed 641 women journalists, media workers, activists and human rights defenders in 119 countries in late 2025. Six per cent had been subjected to deepfakes, meaning fabricated or manipulated images and videos, and 12 per cent had had personal images, including intimate ones, shared without their consent. A 2024 study in Discover Global Society examined romance scams against single women in India and South Africa and called for solidarity groups, cybersecurity education and collaboration among platforms, law enforcement and policymakers. Across all groups, the Federal Bureau of Investigation counted 23,159 romance and confidence complaints in 2025, with $929.3 million in losses, up from $672.0 million in 2024.

People who speak English as a second language. In a 2024 survey by the Take Five campaign, which UK Finance supports, 75 per cent of English-as-a-second-language speakers in the United Kingdom said criminals had tried to trick them.

People offline, in rural areas and in Africa. The International Telecommunication Union finds that 71 per cent of women are online against 77 per cent of men, and 58 per cent of people in rural areas against 85 per cent in cities, and that skills for staying safe online are developing more slowly than basic skills for using the internet. Africa is measured by African and by international bodies. Afrobarometer, a pan-African research network, found in seven countries in February 2026 that 32 per cent of respondents were familiar with tools for protecting themselves online, and that they most often learn about digital safety from friends and family (62 per cent) and social media (60 per cent). The International Criminal Police Organization’s assessment, which draws on its African member countries, and the Global Anti-Scam Alliance’s survey of 4,830 adults, both described above, add to the picture.

People already victimised. The Federal Bureau of Investigation counted 10,516 complaints about recovery scams in 2025, with $1.4 billion in losses, where criminals offer to recover money lost earlier. Among African victims surveyed by the Global Anti-Scam Alliance, 54 per cent had been scammed more than once.

Businesses. Business email compromise, where criminals take over or imitate an email account to redirect a payment, cost $3.046 billion across 24,768 complaints in 2025.

The sources reviewed contain no usable figures for people with disabilities, family carers or migrants, so this essay does not guess them. They are a gap for the report.

Where does the money go, and who gets it back?

Cryptocurrency was involved in 181,565 complaints to the Federal Bureau of Investigation in 2025, with $11.366 billion in losses. Kiosk losses rose 58 per cent on 2024. In response, Indiana became the first state to ban the machines, in a law signed on 9 March 2026, and AARP, the organisation for older Americans (its own name, which no longer spells out the former title), reports that 35 states have passed kiosk laws since 2023, 18 of them in 2026, and that a large operator, Bitcoin Depot, filed for bankruptcy in May 2026.

Speed decides what can be recovered. The Federal Bureau of Investigation’s Recovery Asset Team froze $679 million of $1.164 billion in attempted thefts in 3,900 incidents in 2025, a 58 per cent success rate. In the 642 incidents involving victims aged 60 and over, $32.9 million of $65.4 million was frozen, about half.

Reimbursement rules show what institutions can do. In the United Kingdom, mandatory reimbursement began on 7 October 2024. In its first year, 88 per cent of the money lost to scams covered by the rule, about £173 million, was returned to victims, according to the Payment Systems Regulator. An independent evaluation by Frontier Economics, published on 1 July 2026, estimated that losses covered by the rule fell by about 21 per cent, or £73 million a year, and that reimbursement of all confirmed losses rose from 54 to 65 per cent by value. The same year UK Finance recorded authorised push payment losses of £576.4 million, up 19 per cent across 248,070 cases, and investment fraud of £221.5 million, up 40 per cent. The two sets of figures use different methods and cannot be compared directly.

Other regions are moving the cost further along the chain. In November 2025 the European Union’s Parliament and Council reached a provisional agreement on a Payment Services Regulation under which payment providers refund impersonation fraud in full when the customer reports it to the police and the provider, and online platforms compensate providers when they fail to remove fraudulent content after being notified. Financial-services advertisers must show they are authorised before advertising on major platforms. In Australia the Scams Prevention Framework Act 2025 applies to banks, telecommunications providers and digital platforms, with most obligations applying from 31 March 2027. Singapore is developing a shared-responsibility framework for phishing scams that covers financial institutions and telecommunications companies. The sources reviewed describe no equivalent federal reimbursement rule in the United States.

What changes next?

The Federal Bureau of Investigation describes artificial intelligence as making convincing synthetic content, such as social media profiles and personalised conversations, easy to produce in large quantities. In investment scams, it says, subjects use it to run thousands of conversations that each appear different to each prospective victim. The next step is software that acts for people, such as an assistant that shops, books or answers email. It adds a risk called prompt injection, where hidden instructions in a web page, email or document redirect the assistant. The sources reviewed do not yet count losses from assistants separately, so this risk is described here without a figure.

Which future are we heading towards?

Two questions shape what comes next. The first is whether verification becomes shared, through official call-back lines, labels on genuine content and services such as Scam.org, which the Global Anti-Scam Alliance launched with OpenAI in March 2026 to offer education, checks of suspicious messages and reporting in more than 50 languages, designed for mobile phones. The second is whether protection reaches everyone or follows money and language.

Crossing the two gives four futures, which are scenarios and not forecasts. In the first, verification is shared and reaches everyone, and the early signs are services in many languages and reimbursement rules that include platforms. In the second, the tools exist but serve mainly English speakers and well-regulated countries, and the early signs are rules that differ by jurisdiction and people still offline. In the third, no shared system exists, and people rely on habits they teach one another, such as the family code word, and the early signs are community and library programmes. In the fourth, protection gathers where money and language already are, and the early signs are laws that differ state by state and reporting pages in few languages.

The evidence reviewed points towards the second and fourth futures unless reach improves, and towards the third wherever communities teach each other. This is a reading of the evidence, and the indicators above are what a later report can track.

What can each part of society do?

Families can agree a code word and use the call-back route before sending money. Teachers, librarians, faith leaders and community groups can carry that habit into the languages and formats their communities use, including printed pages for people who are offline. Banks, phone networks and platforms can make the second route easy to find and consider sharing the cost where a scam begins. Software makers can build checks that run on a person’s own phone and keep working when the connection drops. Governments can fund warnings in every language their residents speak, and measure whether the warnings change what people do instead of counting how many were issued. Researchers and journalists can publish the figures by group, since the gaps listed above are gaps in what is counted.

What can a check on a person’s own phone do, and what can it not?

UtilForge.org, a 2026 Champion of Cybersecurity Awareness Month, a programme of the National Cybersecurity Alliance, offers free online safety tools and guides that run on a person’s own phone or computer, so that what someone pastes stays on their phone. A check of this kind can read a message for warning signs, look at a payment request before money moves, or inspect a document before it is shared. It cannot confirm that a person is who they claim to be, because that needs the second route, and a result should say so. A check that runs on the person’s own phone can be offered by a library, a community group or a family to anyone who has one, which is the reach question this essay raises. Whether such checks change what people do is a question for testing.

What will the Digital Trust Deficit report measure?

The report is proposed to measure four things by group: reach (who receives warnings, and in which languages), speed (the time from first contact to the moment a person is told), recovery (the share of money returned), and effect (whether a check changes a decision). Tests of effect would use fictional messages and not live scams, and would compare a guide, a checklist, and a checklist with a tool. It would also collect what this essay could not find: figures for people with disabilities, family carers and migrants.

Whether a warning reaches someone should not depend on who they are.

Lindsay McDonald is a creative and cultural strategist and spokesperson for UtilForge.org, a digital inclusion organisation offering free online safety tools and guides and a 2026 Champion of Cybersecurity Awareness Month.

A related article: “When trust is built to be used later: slow-burn scams, borrowed authority and false warnings” is live at https://utilforge.org/learn/trust-built-to-be-used-later.

Sources for the essay

Free

If you doubt it,
UtilForge it.

Check a forwarded warning, or see what a criminal could find about your family or organisation, on your own phone or computer.

Is this warning real? What could a criminal find? Read the free book

For the household, the Family Safety Tools pack gathers fifteen checks into files you keep. You pay what you want, including nothing.